CVE-2026-31973

creationtimestamp| type| source ---|---|--- 2026-03-18 22:54:10+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mhele6wzhd2p 2026-03-19 21:57:13+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhgyndnh7n2t...

CVE-2026-32703

creationtimestamp| type| source ---|---|--- 2026-03-18 22:47:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhekyphicz2c 2026-03-19 01:30:32+00:00| seen| https://infosec.exchange/users/offseq/statuses/116253250682364300 2026-03-19 01:47:03+00:00| seen|...

CVE-2026-32742

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.17 and 8.6.42, an authenticated user can overwrite server-generated session fields sessionToken, expiresAt, createdWith when creating a session object via POST...

CVE-2026-32742

CVE-2026-32742 affects Parse Server. Before versions 9.6.0-alpha.17 and 8.6.42, an authenticated user could overwrite server-generated session fields (sessionToken, expiresAt, createdWith) when creating a session via POST /classes/_Session, potentially bypassing session expiration and predicting ...

CVE-2026-32742 Parse Server session creation endpoint allows overwriting server-generated session fields

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.17 and 8.6.42, an authenticated user can overwrite server-generated session fields sessionToken, expiresAt, createdWith when creating a session object via POST...

CVE-2026-32742 Parse Server session creation endpoint allows overwriting server-generated session fields

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.17 and 8.6.42, an authenticated user can overwrite server-generated session fields sessionToken, expiresAt, createdWith when creating a session object via POST...

CVE-2026-32742 Parse Server session creation endpoint allows overwriting server-generated session fields

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.17 and 8.6.42, an authenticated user can overwrite server-generated session fields sessionToken, expiresAt, createdWith when creating a session object via POST...

CVE-2026-33310

creationtimestamp| type| source ---|---|--- 2026-03-18 21:02:21+00:00| published-proof-of-concept| https://github.com/intake/intake/security/advisories/GHSA-37g4-qqqv-7m99 2026-03-24 14:54:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhstdtb3tw2v 2026-03-24 23:03:06+00:00| see...

GHSA-WH3H-GVC4-CC2G Statamic is missing authorization check on taxonomy term creation via fieldtype

Impact Low-privileged Control Panel users could create taxonomy terms by submitting requests to the field action processing endpoint with attacker-controlled field definitions. This bypasses the authorization checks enforced on the standard taxonomy term creation endpoint. Patches This has been...

CVE-2026-32730

creationtimestamp| type| source ---|---|--- 2026-03-18 19:48:51+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-v9xm-ffx2-7h35 2026-03-18 23:20:01+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhemshlyzm2u 2026-03-24 23:40:08+00:00| seen|...

CVE-2026-33320

creationtimestamp| type| source ---|---|--- 2026-03-18 19:16:52+00:00| published-proof-of-concept| https://github.com/TomWright/dasel/security/advisories/GHSA-4fcp-jxh7-23x8 2026-05-04 21:00:04+00:00| seen| Telegram/rPnY3cDOMvKcPFRcx6QsxUGiZwWHKwUb91xptawBtUQTSW0 2026-06-01 21:00:04+00:00| seen|...

CVE-2026-31970

creationtimestamp| type| source ---|---|--- 2026-03-18 19:16:21+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-31970 2026-03-18 22:15:10+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mhej6jib5d2r 2026-03-19 22:00:40+00:00| seen|...

Jenkins has a link following vulnerability allows arbitrary file creation

Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted archives to write files to arbitrary locations on the filesystem, restricted only by file system access permissions of the user running...

GHSA-R6QV-FRPC-Q66C Jenkins has a link following vulnerability allows arbitrary file creation

Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted archives to write files to arbitrary locations on the filesystem, restricted only by file system access permissions of the user running...

EUVD-2025-208831

MuraCMS through 10.1.10 contains a CSRF vulnerability in the bundle creation functionality csettings.cfc createBundle method that allows unauthenticated attackers to force administrators to create and save site bundles containing sensitive data to publicly accessible directories. This vulnerabili...

CVE-2026-33293

creationtimestamp| type| source ---|---|--- 2026-03-18 17:16:48+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-xmjm-86qv-g226 2026-03-22 16:17:08+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-33293 2026-03-22...

CVE-2026-32290

creationtimestamp| type| source ---|---|--- 2026-03-18 17:04:14+00:00| seen| https://t.me/truesecator/8008...

CVE-2026-23250

CVE-2026-23250 is a Linux kernel vulnerability in the XFS code path. The issue arises from not checking the return value of xchk_scrub_create_subord, which could yield an ENOMEM mangling the flow. The fix updates xchk_scrub_create_subord to return NULL on allocation failure and adjusts callers to...

CVE-2026-2992

The KiviCare – Clinic & Patient Management System EHR plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization on the /wp-json/kivicare/v1/setup-wizard/clinic REST API endpoint in all versions up to, and including, 4.1.2. This makes it possible for unauthenticated...

CVE-2026-2992

The KiviCare – Clinic & Patient Management System EHR plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization on the /wp-json/kivicare/v1/setup-wizard/clinic REST API endpoint in all versions up to, and including, 4.1.2. This makes it possible for unauthenticated...